markitdown

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script installs and imports the third-party package "markitdown" at runtime using the Tsinghua PyPI mirror (https://pypi.tuna.tsinghua.edu.cn/simple), which fetches and executes remote Python code that the skill requires to run, creating a clear runtime dependency on externally hosted code.